In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix command flush on cable pull
System crash due to command failed to flush back to SCSI layer.
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU: 27 PID: 793455 Comm: kworker/u130:6 Kdump: loaded Tainted: G OE --------- - - 4.18.0-372.9.1.el8.x86_64 #1 Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021 Workqueue: nvme-wq nvme_fc_connect_ctrl_work [nvme_fc] RIP: 0010:__wake_up_common+0x4c/0x190 Code: 24 10 4d 85 c9 74 0a 41 f6 01 04 0f 85 9d 00 00 00 48 8b 43 08 48 83 c3 08 4c 8d 48 e8 49 8d 41 18 48 39 c3 0f 84 f0 00 00 00 <49> 8b 41 18 89 54 24 08 31 ed 4c 8d 70 e8 45 8b 29 41 f6 c5 04 75 RSP: 0018:ffff95f3e0cb7cd0 EFLAGS: 00010086 RAX: 0000000000000000 RBX: ffff8b08d3b26328 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8b08d3b26320 RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffffffffe8 R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8b2fdf6c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000002f1e410002 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: __wake_up_common_lock+0x7c/0xc0 qla_nvme_ls_req+0x355/0x4c0 [qla2xxx] qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae1407ca000 from port 21:32:00:02:ac:07:ee:b8 loop_id 0x02 s_id 01:02:00 logout 1 keep 0 els_logo 0 ? __nvme_fc_send_ls_req+0x260/0x380 [nvme_fc] qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:00:02:ac:07:ee:b8 state transitioned from ONLINE to LOST - portid=010200. ? nvme_fc_send_ls_req.constprop.42+0x1a/0x45 [nvme_fc] qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320002ac07eeb8. rport ffff8ae598122000 roles 1 ? nvme_fc_connect_ctrl_work.cold.63+0x1e3/0xa7d [nvme_fc] qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae14801e000 from port 21:32:01:02:ad:f7:ee:b8 loop_id 0x04 s_id 01:02:01 logout 1 keep 0 els_logo 0 ? __switch_to+0x10c/0x450 ? process_one_work+0x1a7/0x360 qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:01:02:ad:f7:ee:b8 state transitioned from ONLINE to LOST - portid=010201. ? worker_thread+0x1ce/0x390 ? create_worker+0x1a0/0x1a0 qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320102adf7eeb8. rport ffff8ae3b2312800 roles 70 ? kthread+0x10a/0x120 qla2xxx [0000:12:00.1]-2112:3: qla_nvme_unregister_remote_port: unregister remoteport on ffff8ae14801e000 21320102adf7eeb8 ? set_kthread_struct+0x40/0x40 qla2xxx [0000:12:00.1]-2110:3: remoteport_delete of ffff8ae14801e000 21320102adf7eeb8 completed. ? ret_from_fork+0x1f/0x40 qla2xxx [0000:12:00.1]-f086:3: qlt_free_session_done: waiting for sess ffff8ae14801e000 logout
The system was under memory stress where driver was not able to allocate an SRB to carry out error recovery of cable pull. The failure to flush causes upper layer to start modifying scsi_cmnd. When the system frees up some memory, the subsequent cable pull trigger another command flush. At this point the driver access a null pointer when attempting to DMA unmap the SGL.
Add a check to make sure commands are flush back on session tear down to prevent the null pointer access.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-modules-coreUpgrade kernel-64k-modules-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-coreUpgrade kernel-modules-extraUpgrade kernel-debug-coreUpgrade kernel-rt-debug-develUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debug-modules-extraUpgrade kernel-develUpgrade kernel-debug-modules-coreUpgrade kernel-tools-libsUpgrade kernel-rt-modulesUpgrade kernel-uki-virtUpgrade kernel-rt-modules-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-develUpgrade kernel-rt-debugUpgrade kernel-headersUpgrade kernel-debug-modules-extraUpgrade kernel-debug-modulesUpgrade rtlaUpgrade kernel-rt-debug-modules-coreUpgrade kernel-modulesUpgrade kernel-debugUpgrade kernel-64k-debug-develUpgrade kernel-docUpgrade kernel-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-develUpgrade kernel-zfcpdump-develUpgrade kernel-64k-develUpgrade kernel-zfcpdumpUpgrade kernel-toolsUpgrade kernel-rt-modules-extraUpgrade kernel-64k-modules-extraUpgrade kernel-64k-debug-coreUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-rtUpgrade kernel-zfcpdump-devel-matchedUpgrade python3-perfUpgrade kernel-64kUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-coreUpgrade bpftoolUpgrade kernel-64k-coreUpgrade kernelUpgrade libperfUpgrade perfUpgrade kernel-cross-headersUpgrade kernel-64k-debug-modules-extraUpgrade rvUpgrade kernel-abi-stablelistsUpgrade kernel-64k-devel-matchedUpgrade kernel-debug-devel-matchedUpgrade kernel-64k-modulesUpgrade kernel-64k-debug-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-debug | Nov 4, 2024 | May 1, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-5.10.215-203.850Upgrade perf-debuginfoUpgrade kernel-toolsUpgrade kernel-tools-develUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-4.14.345-262.561Upgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade bpftool-debuginfoUpgrade kernel-debuginfoUpgrade bpftoolUpgrade python-perfUpgrade kernel-headersUpgrade python-perf-debuginfo | Aug 14, 2024 | May 1, 2024 |
| Debian | — | Upgrade linux | May 8, 2024 | May 1, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-perfUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-abi-stablelists | Jul 16, 2024 | May 1, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade bpftoolUpgrade kernel | Oct 8, 2024 | May 1, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel | Oct 8, 2024 | May 1, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-toolsUpgrade kernelUpgrade kernel-tools-libsUpgrade python3-perf | Jul 17, 2024 | May 1, 2024 |
| Oracle_linux | — | Upgrade kernel-uekUpgrade kernel | Oct 16, 2024 | May 1, 2024 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Jul 25, 2024 | May 1, 2024 |
| Suse | — | Upgrade kernel-devel-rtUpgrade ocfs2-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade gfs2-kmp-azureUpgrade kernel-rt-livepatchUpgrade dtb-socionextUpgrade dtb-appleUpgrade kernel-docs-htmlUpgrade kernel-default-optionalUpgrade kernel-64kb-optionalUpgrade cluster-md-kmp-64kbUpgrade dtb-renesasUpgrade gfs2-kmp-defaultUpgrade dtb-mediatekUpgrade kernel-default-baseUpgrade kernel-debug-develUpgrade kernel-rt_debugUpgrade reiserfs-kmp-rtUpgrade ocfs2-kmp-azureUpgrade kernel-64kb-develUpgrade kernel-azure-baseUpgrade dtb-allwinnerUpgrade dtb-hisiliconUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt-optionalUpgrade kernel-docsUpgrade kernel-rt-extraUpgrade kernel-obs-buildUpgrade kernel-kvmsmall-livepatch-develUpgrade cluster-md-kmp-rtUpgrade dtb-broadcomUpgrade kernel-source-vanillaUpgrade dtb-nvidiaUpgrade kselftests-kmp-rtUpgrade kernel-azureUpgrade dtb-sprdUpgrade kernel-azure-extraUpgrade kernel-debug-vdsoUpgrade kernel-defaultUpgrade dtb-alteraUpgrade kernel-rt_debug-develUpgrade dtb-caviumUpgrade kselftests-kmp-azureUpgrade kernel-debugUpgrade kernel-rt-develUpgrade kernel-source-rtUpgrade dlm-kmp-defaultUpgrade kernel-64kb-extraUpgrade dtb-amdUpgrade dtb-qcomUpgrade kernel-default-livepatch-develUpgrade dtb-armUpgrade dtb-xilinxUpgrade kernel-kvmsmall-develUpgrade kernel-devel-azureUpgrade ocfs2-kmp-64kbUpgrade dtb-amlogicUpgrade kernel-macrosUpgrade kernel-default-extraUpgrade gfs2-kmp-64kbUpgrade kselftests-kmp-defaultUpgrade kernel-sourceUpgrade kselftests-kmp-64kbUpgrade kernel-azure-vdsoUpgrade kernel-64kb-livepatch-develUpgrade dtb-apmUpgrade kernel-rtUpgrade kernel-default-develUpgrade cluster-md-kmp-defaultUpgrade kernel-azure-livepatch-develUpgrade reiserfs-kmp-64kbUpgrade dtb-freescaleUpgrade kernel-default-livepatchUpgrade dlm-kmp-rtUpgrade dtb-marvellUpgrade kernel-develUpgrade kernel-symsUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debug-livepatch-develUpgrade kernel-default-vdsoUpgrade reiserfs-kmp-azureUpgrade dtb-lgUpgrade dlm-kmp-64kbUpgrade dtb-rockchipUpgrade kernel-kvmsmallUpgrade gfs2-kmp-rtUpgrade ocfs2-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-azure-optionalUpgrade kernel-zfcpdumpUpgrade kernel-default-base-rebuildUpgrade kernel-syms-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-default-manUpgrade kernel-obs-qaUpgrade kernel-source-azureUpgrade kernel-azure-develUpgrade kernel-64kbUpgrade dtb-amazonUpgrade dlm-kmp-azureUpgrade dtb-exynosUpgrade cluster-md-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-rt-vdso | May 15, 2024 | May 1, 2024 |
| Ubuntu | — | Upgrade linux-image-5.15.0-1058-ibmUpgrade linux-image-5.4.0-1040-iotUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-35-generic-64kUpgrade linux-image-5.15.0-1060-nvidia-lowlatencyUpgrade linux-image-6.8.0-1004-gkeUpgrade linux-image-6.8.0-1006-oracle-64kUpgrade linux-image-5.15.0-1062-gkeUpgrade linux-image-5.4.0-1075-ibmUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.4.0-1128-awsUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-aws-lts-20.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-5.4.0-189-genericUpgrade linux-image-6.8.0-35-genericUpgrade linux-image-azure-cvmUpgrade linux-image-6.8.0-35-lowlatency-64kUpgrade linux-image-6.8.0-1006-oracleUpgrade linux-image-5.4.0-1088-bluefieldUpgrade linux-image-5.4.0-1047-xilinx-zynqmpUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.15.0-1063-oracleUpgrade linux-image-aws-lts-22.04Upgrade linux-image-kvmUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-virtualUpgrade linux-image-5.4.0-1116-kvmUpgrade linux-image-5.15.0-1068-azureUpgrade linux-image-5.15.0-1060-nvidiaUpgrade linux-image-6.8.0-1008-azure-fdeUpgrade linux-image-5.15.0-1065-gcpUpgrade linux-image-5.15.0-1048-gkeopUpgrade linux-image-oracleUpgrade linux-image-awsUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.8.0-1006-oemUpgrade linux-image-5.4.0-1095-gkeopUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-bluefieldUpgrade linux-image-5.4.0-1133-azureUpgrade linux-image-azure-lts-20.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-azure-fdeUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-gkeop-5.4Upgrade linux-image-5.15.0-116-genericUpgrade linux-image-raspi2Upgrade linux-image-5.15.0-116-lowlatency-64kUpgrade linux-image-oem-20.04dUpgrade linux-image-oem-osp1Upgrade linux-image-5.15.0-116-generic-64kUpgrade linux-image-5.4.0-189-lowlatencyUpgrade linux-image-5.4.0-1127-oracleUpgrade linux-image-5.15.0-116-lowlatencyUpgrade linux-image-ibm-classicUpgrade linux-image-raspiUpgrade linux-image-gkeUpgrade linux-image-generic-lpaeUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-azureUpgrade linux-image-gkeopUpgrade linux-image-5.15.0-1064-gcpUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-oem-24.04Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-intelUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-35-lowlatencyUpgrade linux-image-oem-20.04bUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1008-azureUpgrade linux-image-oemUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-5.4.0-1112-raspiUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.8.0-1009-awsUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-oracle-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1005-raspiUpgrade linux-image-5.15.0-1062-kvmUpgrade linux-image-genericUpgrade linux-image-gke-5.15Upgrade linux-image-nvidiaUpgrade linux-image-5.15.0-1065-awsUpgrade linux-image-5.15.0-116-generic-lpaeUpgrade linux-image-oem-20.04Upgrade linux-image-intel-iotgUpgrade linux-image-gcpUpgrade linux-image-5.15.0-1068-azure-fdeUpgrade linux-image-5.4.0-1132-gcpUpgrade linux-image-ibmUpgrade linux-image-lowlatencyUpgrade linux-image-lowlatency-64kUpgrade linux-image-5.15.0-1060-intel-iotgUpgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-6.8.0-1008-gcpUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.4.0-189-generic-lpaeUpgrade linux-image-6.8.0-1006-ibmUpgrade linux-image-azure-lts-22.04Upgrade linux-image-oem-20.04cUpgrade linux-image-generic-hwe-24.04 | Jul 1, 2024 | May 1, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub